22018, 1/1101 ȸ¿ø°¡ÀÔ  ·Î±×ÀΠ 
   gksqlcthxm
   dllÀÎÁ§¼Ç Äڵ尡 ¸Â´Â°Å°°Àºµ¥ Á¦´ë·Î ÀÎÁ§¼ÇÀÌ ¾ÈµÇ³»¿ä

http://www.hackerschool.org/HS_Boards/zboard.php?AllArticle=true&no=35048 [º¹»ç]


ÀÎÅͳÝÀ̳ª ³ª¹µÀÙÃ¥À¸·Î ¼ö½Ê¹ø º¸¸ç ºñ±³¸¦ Çߴµ¥
´õÀÌ»ó Æ²¸°°÷ÀÌ ¾ø´Â°Å °°Àºµ¥ ÀÎÁ§¼ÇÀÌ ¾ÈµË´Ï´Ù.
¿¡·¯³ª ¿ö´×µµ ¾ø°í ±×³É ³¡±îÁö ½ÇÇàÀº µÇ´Âµ¥ ÀÎÁ§¼Ç ±â´ÉÀÌ ¾ÈµÇ¿ä
´Ù¸¥ ÇÁ·Î±×·¡¹Ö Ä«Æä¿¡¼­µµ µµ¿òÀ» ûÇߴµ¥ ÇØ°áÀ» ¸øÇÏ¿© Ȥ½Ã³ªÇؼ­ Áú¹® µå¸³¤¤´Ù!

void injection(DWORD dwPid, LPCTSTR szDllPath)
{
        HANDLE hProcess, hThread;
        HMODULE hKernel32;
        LPTHREAD_START_ROUTINE pThreadProc;
        LPVOID pLibbuf;
        //PROCESSENTRY32 pe = { sizeof(pe) }; // Ãß°¡·Î ½ÃµµÇغ» °Í

        int nLen= strlen(szDllPath)+1;
        //pe.th32ProcessID = dwPid; // Ãß°¡·Î ½ÃµµÇغ» °Í

        if ( !(hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid)) )
        {
                printf("failed");
        }
                
        pLibbuf = VirtualAllocEx(hProcess, NULL, nLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
        WriteProcessMemory(hProcess, pLibbuf, (LPVOID)szDllPath, nLen, NULL);
        hKernel32 = GetModuleHandle("kernel32.dll");
        pThreadProc = (LPTHREAD_START_ROUTINE)GetProcAddress(hKernel32, "LoadLibraryA");  
        hThread = CreateRemoteThread(hProcess, NULL, 0, pThreadProc, pLibbuf, 0, NULL);
        WaitForSingleObject(hThread,INFINITE);
CloseHandle(hThread);
CloseHandle(hProcess);

}

¸ÞÀÎÇÔ¼ö

        DWORD dwPid;
        char dll_path[20];

        printf("ÇÁ·Î¼¼½º ID¸¦ ÀÔ·ÂÇϼ¼¿ä");
        scanf("%d",&dwPid);
                
        printf("dll°æ·Î¸¦ ÀÔ·ÂÇϼ¼¿ä");
        scanf("%s",dll_path);

                injection(dwPid,dll_path);

  Hit : 8187     Date : 2017/06/13 07:24



    
ÇØÄð·¯ º¸Åë ÀÌ·±°Ç À©µµXP¿¡¼­ ÇÏ¼Å¾ß Àߵ˴ϴ٠¾Æ´Ï¸é »ç¿ëÇÏ°í °è½Å OS»ó¿¡¼­ °ü¸®ÀÚ±ÇÇÑÀ¸·Î injector¸¦ ½ÇÇà½ÃÄѺ¸¼Å¿ä ±×·¸°Ô È®ÀÎÀ» ÇØº¸¼Ì´Ù¸é ¼Ò½ºÄڵ忡¼­ÀÇ ¹®Á¦´Â ´Ù ÀâÀ¸¼ÌÀ»°Ì´Ï´Ù ±×´ÙÀ½¿¡´Â ȯ°æ¿¡¼­ÀÇ ¹®Á¦¸¦ È®ÀÎÇØº¸¼Å¾ßÇÕ´Ï´Ù 2017/06/13  
gksqlcthxm ¸»¾¸ÇØÁֽŠos,±ÇÇÑ ¸»°í ¾î¶² ȯ°æÀÌ ÀÖ³ª¿ä...... 2017/06/13  
ÇØÄð·¯ Á¦°¡ ¸»ÇÑ È¯°æÀÌ ±×°É ¾ê±âÇѰſ´½À´Ï´Ù ±×¸®°í injectorÄڵ忡 °¢ ½ºÅÜÀÌ ½ÇÆÐÇßÀ» ¶§ ¿¹¿Üó¸®ÇÏ´Â Äڵ尡 ¾ø´Âµ¥, °¢°¢ ÇÔ¼ö ½ÇÇà¿¡¼­ ¿¡·¯Äڵ尡 ¸®ÅϵǴÂÁö È®ÀÎÇÏ°í ¾î´À ÇÔ¼ö¿¡¼­ Á¦´ë·Î µ¿ÀÛÇÏÁö ¾Ê¾Æ¼­ ÀÎÁ§¼ÇÀÌ ¾ÈµÇ´Â°ÇÁö Çϳª¾¿ º¸¼Å¾ßÇÕ´Ï´Ù 2017/06/13  
gksqlcthxm GetLastErrorÇÔ¼ö·Î if ( !(hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid)) )
À̺κРȮÀÎÇÏ´Ï 87¹øÀ̾ù³ª ÀÎÀÚ°ª ¿¡·¯¶ó°í ³ª¿Ô´Âµ¥ µµ¹«Áö Ʋ¸° ºÎºÐÀÌ ¾ø´Â°Å °°¾Æ¼­ ¹ÌÄ¡°Ù½À´Ï´Ù ¾Õ¿¡ µÎ ÀÎÀÚ´Â 100% È®½ÇÇÏ´Ï dwPid°¡ ¹®Á¦¶ó´Â°Çµ¥ injectionÇÔ¼ö¸»°í dllÀ̳ª ÇÁ·Î¼¼½º ¸ñ·ÏÀ» Ãâ·ÂÇÒ¶§µµ dwPidÀÎÀÚ¸¦ ¸ÞÀÎÇÔ¼ö¿¡¼­Ã³·³ ¶È°°ÀÌ Àü´ÞÇ޴µ¥ injectionÇÔ¼ö¿¡¼­¸¸ ¿À·ù°¡ ³ª´Ï ´ä´äÇØ¼­ ¹ÌÄ¡°Ú³×¿ä.
2017/06/13  
gksqlcthxm µð¹ö±ë½Ã¿£ WriteProcessMemory(hProcess, pLibbuf, (LPVOID)szDllPath, nLen, NULL); ÇÔ¼ö°¡ ½ÇÇàµÇ¸é szDllPath Áï ÀÔ·ÂÇÑ dllÀÇ °æ·Î°¡ pLibbuf¿¡ µé¾î°¡¾ß Á¤»óÀΰ¡¿ä?
pLibbuf¸¦ ã¾Æ°¡º¸¸é dll°æ·Î°¡ ¾ø´Âµ¥ ÀÌ°Ô ¹®Á¦ÀÎÁö.
2017/06/13  
rabbitlycat int nLen= strlen(szDllPath)+1;
¿¡¼­ +1À» »©¼¼¿°
2017/06/14  
gksqlcthxm msdn¿¡¼­µµ +1 Ç϶ó ±×·¯°í ´Ù¸¥ ºÐµéÀ̳ª Ã¥¿¡¼­µµ ´Ù +1ÀÌ Àֱ淡 ¸»¾¸µè°í »©ºÃ´õ´Ï µÇ³×¿ä ÀÌÀ¯´Â ¸ð¸£°ÚÁö¸¸ °¨»çÇÕ´Ï´Ù 2017/06/15